Add redis sessions and reauth to admin app

This PR also contains the redis session commit, plus changes things to set a
prefix. I'm happy to rebase the original PR, but it might be easier to commit
this as a single PR.
Yes I see what you mean - can add some tests if I break the validation steps down into standalone methods. Also by doing this realised I wasn't actually checking that the first value was 'Bearer'